feat: use Nuri passkey wallets as Buzz identities

[eminogrande]

Summary

• derive the exact nuri-expo-wallet-v1 wallet from a nuri.com WebAuthn PRF result
• add Connect Create/Access handoff and verify the complete public wallet tuple
• keep only the Nostr signer in tab memory and zeroize all other private material
• add payload-bound NIP-98 registration for approved Connect wallets while keeping relay membership closed
• document the Nuri deployment architecture in README

Security invariants

• no PRF output or private key leaves the browser
• no private key persistence in browser or relay storage
• Connect nostr_pubkey_hex must equal the NIP-98 signer
• Connect flow, kind, session id, approval URL, and return nonce must all match
• the return nonce and pending session stay in tab-local sessionStorage
• registration remains rate-limited and replay-protected
• BUZZ_REQUIRE_RELAY_MEMBERSHIP=true remains enabled

Verification

• pnpm check
• pnpm test:unit — 5 passed
• pnpm test:e2e:smoke — 6 passed
• cargo test -p buzz-relay api::nuri::tests --lib — 3 passed
• cargo clippy -p buzz-relay --lib -- -D warnings
• live browser CORS checks: Access and Create start/result HTTP 200 with exact kind/session binding
• live VPS server-to-server Connect result check HTTP 200

Closes #1

Session: @session:default/20260724_150854_84a994